1. 应用程序所在目录（Application Directory）
2. 当前目录（Current Directory）
3. Windows 系统目录（%SystemRoot%\System32）
4. Windows 16位系统目录（%SystemRoot%\System）
5. Windows 目录（%SystemRoot%）
6. PATH 环境变量中列出的目录

1. 应用程序所在目录（Application Directory）
2. Windows 系统目录（%SystemRoot%\System32）
3. Windows 16位系统目录（%SystemRoot%\System）
4. Windows 目录（%SystemRoot%）
5. 当前目录（Current Directory）
6. PATH 环境变量中列出的目录

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
    SafeDllSearchMode = 1（DWORD）

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs

advapi32     = advapi32.dll
kernel32     = kernel32.dll
ntdll        = ntdll.dll
user32       = user32.dll
ws2_32       = ws2_32.dll
ole32        = ole32.dll
shell32      = shell32.dll
shlwapi      = shlwapi.dll
rpcrt4       = rpcrt4.dll

$knownDllsPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs"
$knownDlls = Get-ItemProperty -Path $knownDllsPath
$knownDlls.PSObject.Properties | Where-Object { $_.Name -notmatch '^PS' } | ForEach-Object {
    $dllName = $_.Value
    $expectedPath = "C:\Windows\System32\$dllName"
    $actualPath = Join-Path "C:\Windows\System32" $dllName
    if (Test-Path $actualPath) {
        $hash = (Get-FileHash -Path $actualPath -Algorithm SHA256).Hash
        [PSCustomObject]@{
            Name = $_.Name
            DLL = $dllName
            Path = $actualPath
            SHA256 = $hash
        }
    }
}

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\<application.exe>
    (Default) = C:\Path\To\Application.exe
    Path = C:\Custom\DLL\Directory

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<application.exe>
    Debugger = C:\Path\To\Debugger.exe

过滤器配置：
- Operation: CreateFile
- Result: NAME NOT FOUND
- Path: ends with .dll

#include <windows.h>

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) {
    switch (fdwReason) {
        case DLL_PROCESS_ATTACH:
            WinExec("cmd.exe /c powershell -enc <base64_payload>", SW_HIDE);
            break;
    }
    return TRUE;
}

C:\Program Files\TargetApp\helper.dll

<Event>
  <System>
    <Provider Name="Microsoft-Windows-Sysmon" Guid="{5770385f-c22a-43e0-bf4c-06f5698ffbd9}" />
    <EventID>7</EventID>
    <Version>3</Version>
    <Level>4</Level>
    <Task>7</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2026-06-20T08:15:32.456789100Z" />
    <Channel>Microsoft-Windows-Sysmon/Operational</Channel>
    <Computer>WORKSTATION-01</Computer>
  </System>
  <EventData>
    <Data Name="RuleName">DLL Hijack Detection</Data>
    <Data Name="UtcTime">2026-06-20 08:15:32.456</Data>
    <Data Name="ProcessGuid">{a1b2c3d4-e5f6-7890-abcd-ef1234567890}</Data>
    <Data Name="ProcessId">4872</Data>
    <Data Name="Image">C:\Program Files\TargetApp\legitimate_app.exe</Data>
    <Data Name="ImageLoaded">C:\Program Files\TargetApp\helper.dll</Data>
    <Data Name="FileVersion">-</Data>
    <Data Name="Description">-</Data>
    <Data Name="Product">-</Data>
    <Data Name="Company">-</Data>
    <Data Name="OriginalFileName">-</Data>
    <Data Name="Hashes">SHA256=E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855</Data>
    <Data Name="Signed">false</Data>
    <Data Name="SignatureStatus">Unavailable</Data>
  </EventData>
</Event>

过滤器：
- Path contains ".dll" AND Result is "SUCCESS" AND Path contains "C:\Users\"
- Path contains ".dll" AND Result is "SUCCESS" AND Path contains "C:\Temp\"
- Path contains ".dll" AND Result is "SUCCESS" AND Path contains "C:\ProgramData\"

$procmonLog = Import-Csv "C:\temp\procmon_export.csv"
$phantomDlls = $procmonLog | Where-Object {
    $_.Operation -eq "CreateFile" -and
    $_.Result -eq "NAME NOT FOUND" -and
    $_.Path -match "\.dll$"
} | Select-Object -Property Path -Unique

$phantomDlls | ForEach-Object {
    Write-Host "Phantom DLL candidate: $($_.Path)"
}

#include <windows.h>

#pragma comment(linker, "/EXPORT:InitHelper=_InitHelperImpl")

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) {
    switch (fdwReason) {
        case DLL_PROCESS_ATTACH: {
            HANDLE hThread = CreateThread(NULL, 0, PayloadThread, NULL, 0, NULL);
            CloseHandle(hThread);
            break;
        }
    }
    return TRUE;
}

DWORD WINAPI PayloadThread(LPVOID lpParam) {
    Sleep(5000);
    STARTUPINFOA si = { sizeof(STARTUPINFOA) };
    PROCESS_INFORMATION pi;
    CreateProcessA(NULL, "cmd.exe /c powershell -ep bypass -enc <payload>",
                   NULL, NULL, TRUE, CREATE_NO_WINDOW, NULL, NULL, &si, &pi);
    CloseHandle(pi.hProcess);
    CloseHandle(pi.hThread);
    return 0;
}

$baseline = Import-Csv "C:\temp\baseline_procmon.csv"
$current = Import-Csv "C:\temp\current_procmon.csv"

$newlyResolved = foreach ($entry in ($current | Where-Object {
    $_.Operation -eq "CreateFile" -and $_.Result -eq "SUCCESS" -and $_.Path -match "\.dll$"
})) {
    $wasNotFound = ($baseline | Where-Object {
        $_.Path -eq $entry.Path -and $_.Result -eq "NAME NOT FOUND"
    })
    if ($wasNotFound) { $entry }
}

$newlyResolved | Format-Table Path, ProcessName -AutoSize

C:\Program Files\SignedApp\updates\
C:\Program Files\SignedApp\plugins\
C:\Program Files\SignedApp\temp\

$signedApps = Get-ChildItem "C:\Program Files" -Recurse -Filter "*.exe" | ForEach-Object {
    $sig = Get-AuthenticodeSignature $_.FullName
    if ($sig.Status -eq "Valid") {
        [PSCustomObject]@{
            Path = $_.FullName
            Signer = $sig.SignerCertificate.Subject
            WritableDirs = (Get-ChildItem $_.DirectoryName -Directory | Where-Object {
                (Get-Acl $_.FullName).Access | Where-Object {
                    $_.IdentityReference -match "Users|Everyone" -and
                    $_.FileSystemRights -match "Write"
                }
            }).FullName
        }
    }
}
$signedApps | Where-Object { $_.WritableDirs.Count -gt 0 } | Format-List

$pe = [System.Reflection.Assembly]::LoadFile("C:\Program Files\SignedApp\app.exe")
$imports = [PeParser]::GetImports("C:\Program Files\SignedApp\app.exe")
$imports | Where-Object { $_.Path -notmatch "System32|SysWOW64" } | Format-Table

$dllEvents = Get-WinEvent -FilterHashtable @{
    LogName = "Microsoft-Windows-Sysmon/Operational"
    Id = 7
} -MaxEvents 5000

foreach ($event in $dllEvents) {
    $xml = [xml]$event.ToXml()
    $image = ($xml.Event.EventData.Data | Where-Object { $_.Name -eq "Image" }).'#text'
    $imageLoaded = ($xml.Event.EventData.Data | Where-Object { $_.Name -eq "ImageLoaded" }).'#text'
    $signed = ($xml.Event.EventData.Data | Where-Object { $_.Name -eq "Signed" }).'#text'

    $hostSig = Get-AuthenticodeSignature $image -ErrorAction SilentlyContinue
    $dllSig = Get-AuthenticodeSignature $imageLoaded -ErrorAction SilentlyContinue

    if ($hostSig.Status -eq "Valid" -and $dllSig.Status -ne "Valid") {
        [PSCustomObject]@{
            Time = $event.TimeCreated
            HostProcess = $image
            HostSigner = $hostSig.SignerCertificate.Subject
            LoadedDLL = $imageLoaded
            DLLSigned = $signed
            Alert = "Signed app loaded unsigned DLL"
        }
    }
}

系统级（需要管理员权限）：
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CLSID}\

用户级（仅需当前用户权限）：
HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CLSID}\

HKCU\SOFTWARE\Classes\CLSID\{target-clsid}\InprocServer32
    (Default) = C:\Path\To\Malicious.dll
    ThreadingModel = Apartment

$clsid = "{00000000-0000-0000-0000-000000000000}"
$regPath = "HKCU:\SOFTWARE\Classes\CLSID\$clsid\InprocServer32"
New-Item -Path $regPath -Force
Set-ItemProperty -Path $regPath -Name "(Default)" -Value "C:\Temp\malicious.dll"
Set-ItemProperty -Path $regPath -Name "ThreadingModel" -Value "Apartment"

HKCU\SOFTWARE\Classes\CLSID\{target-clsid}\LocalServer32
    (Default) = "C:\Path\To\Malicious.exe" -embedding

HKCU\SOFTWARE\Classes\CLSID\{original-clsid}\TreatAs
    (Default) = {malicious-clsid}

$monitoredPaths = @(
    "HKCU:\SOFTWARE\Classes\CLSID",
    "HKLM:\SOFTWARE\Classes\CLSID"
)

foreach ($path in $monitoredPaths) {
    $baseline = Get-ChildItem $path -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSChildName
    }
    Set-Content "C:\temp\com_baseline_$(Split-Path $path -Leaf).txt" $baseline
}

$suspiciousClsids = Get-ChildItem "HKCU:\SOFTWARE\Classes\CLSID" -ErrorAction SilentlyContinue

foreach ($clsid in $suspiciousClsids) {
    $inproc = Get-ItemProperty "$($clsid.PSPath)\InprocServer32" -ErrorAction SilentlyContinue
    $local = Get-ItemProperty "$($clsid.PSPath)\LocalServer32" -ErrorAction SilentlyContinue
    $treatAs = Get-ItemProperty "$($clsid.PSPath)\TreatAs" -ErrorAction SilentlyContinue

    if ($inproc) {
        $dllPath = $inproc.'(default)'
        if ($dllPath -and ($dllPath -match "Temp|Users|Downloads|AppData" -or -not (Test-Path $dllPath))) {
            [PSCustomObject]@{
                CLSID = $clsid.PSChildName
                Type = "InprocServer32"
                Target = $dllPath
                Exists = Test-Path $dllPath
                Suspicious = $true
            }
        }
    }

    if ($treatAs) {
        [PSCustomObject]@{
            CLSID = $clsid.PSChildName
            Type = "TreatAs"
            Target = $treatAs.'(default)'
            Exists = $null
            Suspicious = $true
        }
    }
}

TargetDLL.TargetFunction

#include <windows.h>

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) {
    switch (fdwReason) {
        case DLL_PROCESS_ATTACH: {
            char cmdLine[512];
            wsprintfA(cmdLine, "cmd.exe /c echo compromised > C:\\Temp\\dll_hijack_proof.txt");
            STARTUPINFOA si = { sizeof(STARTUPINFOA) };
            PROCESS_INFORMATION pi;
            CreateProcessA(NULL, cmdLine, NULL, NULL, FALSE,
                           CREATE_NO_WINDOW, NULL, NULL, &si, &pi);
            CloseHandle(pi.hProcess);
            CloseHandle(pi.hThread);
            break;
        }
    }
    return TRUE;
}

LIBRARY VERSION.dll
EXPORTS
    GetFileVersionInfoA = C:\Windows\System32\VERSION.dll.GetFileVersionInfoA
    GetFileVersionInfoSizeA = C:\Windows\System32\VERSION.dll.GetFileVersionInfoSizeA
    VerInstallFileA = C:\Windows\System32\VERSION.dll.VerInstallFileA
    VerQueryValueA = C:\Windows\System32\VERSION.dll.VerQueryValueA

function Analyze-DllExports {
    param([string]$DllPath)

    $bytes = [System.IO.File]::ReadAllBytes($DllPath)
    $peOffset = [BitConverter]::ToInt32($bytes, 0x3C)
    $exportDirRVA = [BitConverter]::ToInt32($bytes, $peOffset + 0x78)

    if ($exportDirRVA -eq 0) {
        Write-Host "No export table found"
        return
    }

    Write-Host "Export directory RVA: 0x$($exportDirRVA.ToString('X8'))"
    Write-Host "Analyzing export forwarding entries..."

    $sections = Parse-SectionHeaders $bytes $peOffset
    foreach ($export in (Parse-ExportTable $bytes $exportDirRVA $sections)) {
        if ($export.ForwarderRVA -ne 0) {
            $forwarderName = Read-StringAtRVA $bytes $export.ForwarderRVA $sections
            if ($forwarderName -match "^[A-Z]:\\") {
                Write-Host "[ALERT] Absolute path forward: $($export.Name) -> $forwarderName" -ForegroundColor Red
            } else {
                Write-Host "[INFO] Standard forward: $($export.Name) -> $forwarderName"
            }
        }
    }
}

<Sysmon schemaversion="4.90">
  <EventFiltering>
    <RuleGroup name="DLLLoadMonitoring" groupRelation="or">
      <ImageLoad onmatch="exclude">
        <Image condition="is">C:\Windows\System32\svchost.exe</Image>
        <ImageLoaded condition="begin with">C:\Windows\System32\</ImageLoaded>
        <Signature condition="is">Microsoft Windows</Signature>
      </ImageLoad>
    </RuleGroup>
  </EventFiltering>
</Sysmon>

$dllEvents = Get-WinEvent -FilterHashtable @{
    LogName = "Microsoft-Windows-Sysmon/Operational"
    Id = 7
} -MaxEvents 10000

$results = foreach ($event in $dllEvents) {
    $xml = [xml]$event.ToXml()
    $data = $xml.Event.EventData.Data
    $image = ($data | Where-Object { $_.Name -eq "Image" }).'#text'
    $imageLoaded = ($data | Where-Object { $_.Name -eq "ImageLoaded" }).'#text'
    $signed = ($data | Where-Object { $_.Name -eq "Signed" }).'#text'
    $sigStatus = ($data | Where-Object { $_.Name -eq "SignatureStatus" }).'#text'
    $hashes = ($data | Where-Object { $_.Name -eq "Hashes" }).'#text'
    $description = ($data | Where-Object { $_.Name -eq "Description" }).'#text'
    $originalFileName = ($data | Where-Object { $_.Name -eq "OriginalFileName" }).'#text'

    $riskScore = 0
    $alerts = @()

    if ($signed -eq "false") { $riskScore += 30; $alerts += "Unsigned DLL" }
    if ($imageLoaded -match "C:\\Users\\|C:\\Temp\\|C:\\ProgramData\\") {
        $riskScore += 25; $alerts += "Non-standard path"
    }
    if (-not $description -or $description -eq "-") { $riskScore += 15; $alerts += "No description" }
    if ($originalFileName -and $originalFileName -ne "-") {
        $loadedFileName = Split-Path $imageLoaded -Leaf
        if ($originalFileName -ne $loadedFileName) {
            $riskScore += 20; $alerts += "FileName mismatch"
        }
    }

    if ($riskScore -ge 40) {
        [PSCustomObject]@{
            Time = $event.TimeCreated
            Process = Split-Path $image -Leaf
            DLL = $imageLoaded
            RiskScore = $riskScore
            Alerts = ($alerts -join "; ")
            Hash = $hashes
        }
    }
}

$results | Sort-Object RiskScore -Descending | Format-Table -AutoSize

1. Operation is CreateFile → Include
2. Path ends with .dll → Include
3. Path contains \Windows\ → Exclude
4. Path contains \WinSxS\ → Exclude
5. Result is NAME NOT FOUND → Highlight Red
6. Result is SUCCESS AND Path contains \Users\ → Highlight Yellow

$csv = Import-Csv "C:\temp\procmon_dll_analysis.csv"

$failedLoads = $csv | Where-Object {
    $_.Operation -eq "CreateFile" -and
    $_.Result -eq "NAME NOT FOUND" -and
    $_.Path -match "\.dll$"
} | Group-Object { Split-Path $_.Path -Leaf } | Sort-Object Count -Descending

Write-Host "=== Top 20 Missing DLLs ==="
$failedLoads | Select-Object -First 20 | ForEach-Object {
    Write-Host "$($_.Count) attempts: $($_.Name)"
}

$successFromTemp = $csv | Where-Object {
    $_.Operation -eq "CreateFile" -and
    $_.Result -eq "SUCCESS" -and
    $_.Path -match "\.dll$" -and
    $_.Path -match "C:\\Temp|C:\\Users\\.*\\AppData\\Local\\Temp"
}

Write-Host "`n=== DLLs Loaded from Temp ==="
$successFromTemp | ForEach-Object {
    Write-Host "$($_.ProcessName) loaded $($_.Path)" -ForegroundColor Yellow
}

volatility -f memory.dmp ldrmodules --pid=4872

volatility -f memory.dmp dlllist --pid=4872

volatility -f memory.dmp malfind --pid=4872

$systemDlls = Get-ChildItem "C:\Windows\System32\*.dll" | ForEach-Object {
    [PSCustomObject]@{
        Name = $_.Name
        Path = $_.FullName
        SHA256 = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
        Size = $_.Length
        LastWriteTime = $_.LastWriteTime
        Signed = (Get-AuthenticodeSignature $_.FullName).Status -eq "Valid"
    }
}
$systemDlls | Export-Csv "C:\temp\system_dll_baseline.csv" -NoTypeInformation

$suspiciousDlls = Import-Csv "C:\temp\suspicious_dlls.csv"
$baseline = Import-Csv "C:\temp\system_dll_baseline.csv"

foreach ($dll in $suspiciousDlls) {
    $match = $baseline | Where-Object { $_.Name -eq (Split-Path $dll.Path -Leaf) }
    if ($match) {
        if ($dll.SHA256 -ne $match.SHA256) {
            Write-Host "[ALERT] Hash mismatch: $($dll.Path)" -ForegroundColor Red
            Write-Host "  Expected: $($match.SHA256)"
            Write-Host "  Actual:   $($dll.SHA256)"
        }
    } else {
        Write-Host "[INFO] No baseline for: $($dll.Path)" -ForegroundColor Yellow
    }
}

function Verify-DllSignature {
    param([string]$DllPath)

    $sig = Get-AuthenticodeSignature $DllPath
    $result = [PSCustomObject]@{
        Path = $DllPath
        Status = $sig.Status.ToString()
        Signer = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { "N/A" }
        Issuer = if ($sig.SignerCertificate) { $sig.SignerCertificate.Issuer } else { "N/A" }
        Timestamp = if ($sig.TimeStamperCertificate) { $sig.TimeStamperCertificate } else { "N/A" }
    }

    if ($sig.Status -ne "Valid") {
        $result | Add-Member -NotePropertyName "Alert" -NotePropertyValue "Invalid or missing signature"
    }

    if ($sig.SignerCertificate) {
        $chain = New-Object System.Security.Cryptography.X509Certificates.X509Chain
        $chain.Build($sig.SignerCertificate.Certificate) | Out-Null
        $result | Add-Member -NotePropertyName "ChainLength" -NotePropertyValue $chain.ChainElements.Count
    }

    $result
}

function Get-DllHijackRiskScore {
    param(
        [string]$DllPath,
        [string]$HostProcess,
        [bool]$IsSigned,
        [string]$SignatureStatus,
        [string]$Description,
        [string]$OriginalFileName
    )

    $score = 0
    $factors = @()

    $suspiciousPaths = @("C:\Temp", "C:\Users\*\AppData\Local\Temp", "C:\ProgramData", "C:\Users\Public")
    foreach ($pattern in $suspiciousPaths) {
        if ($DllPath -like $pattern) {
            $score += 30
            $factors += "Suspicious path (+30)"
            break
        }
    }

    if (-not $IsSigned) { $score += 25; $factors += "Unsigned (+25)" }
    if ($SignatureStatus -eq "NotSigned") { $score += 5; $factors += "Not signed at all (+5)" }
    if (-not $Description -or $Description -eq "-") { $score += 10; $factors += "No description (+10)" }

    $dllFileName = Split-Path $DllPath -Leaf
    if ($OriginalFileName -and $OriginalFileName -ne "-" -and $OriginalFileName -ne $dllFileName) {
        $score += 20
        $factors += "Filename mismatch (+20)"
    }

    $systemDllNames = @("ntdll.dll", "kernel32.dll", "user32.dll", "advapi32.dll", "ws2_32.dll", "wininet.dll")
    if ($dllFileName -in $systemDllNames -and $DllPath -notlike "C:\Windows\*") {
        $score += 40
        $factors += "System DLL name from non-system path (+40)"
    }

    $level = switch ($score) {
        { $_ -ge 70 } { "CONFIRMED MALICIOUS" }
        { $_ -ge 50 } { "HIGH SUSPICION" }
        { $_ -ge 30 } { "ATTENTION" }
        default { "LOW RISK" }
    }

    [PSCustomObject]@{
        DllPath = $DllPath
        HostProcess = $HostProcess
        Score = $score
        Level = $level
        Factors = ($factors -join "; ")
    }
}

2025-03-15 09:23:01 - 安全软件更新程序启动（正常行为）
2025-03-15 09:23:01 - 加载恶意 DLL（Event ID 7，路径异常）
2025-03-15 09:23:02 - DllMain 执行，释放 payload 到 %TEMP%
2025-03-15 09:23:03 - 创建 PowerShell 子进程（Event ID 1）
2025-03-15 09:23:05 - PowerShell 建立 outbound 连接到 C2（Event ID 3）
2025-03-15 09:23:06 - C2 返回命令，开始横向移动

function Invoke-DllHijackHunt {
    [CmdletBinding()]
    param(
        [string]$OutputPath = "C:\temp\dll_hijack_report.csv",
        [int]$MaxEvents = 50000,
        [switch]$IncludeLowRisk
    )

    $results = [System.Collections.ArrayList]::new()

    $dllEvents = Get-WinEvent -FilterHashtable @{
        LogName = "Microsoft-Windows-Sysmon/Operational"
        Id = 7
    } -MaxEvents $MaxEvents -ErrorAction SilentlyContinue

    $systemPaths = @(
        "C:\Windows\System32",
        "C:\Windows\SysWOW64",
        "C:\Windows\WinSxS",
        "C:\Windows\assembly"
    )

    foreach ($event in $dllEvents) {
        $xml = [xml]$event.ToXml()
        $data = $xml.Event.EventData.Data
        $image = ($data | Where-Object { $_.Name -eq "Image" }).'#text'
        $imageLoaded = ($data | Where-Object { $_.Name -eq "ImageLoaded" }).'#text'
        $signed = ($data | Where-Object { $_.Name -eq "Signed" }).'#text'
        $sigStatus = ($data | Where-Object { $_.Name -eq "SignatureStatus" }).'#text'
        $hashes = ($data | Where-Object { $_.Name -eq "Hashes" }).'#text'
        $description = ($data | Where-Object { $_.Name -eq "Description" }).'#text'
        $product = ($data | Where-Object { $_.Name -eq "Product" }).'#text'
        $company = ($data | Where-Object { $_.Name -eq "Company" }).'#text'
        $originalFileName = ($data | Where-Object { $_.Name -eq "OriginalFileName" }).'#text'

        $score = 0
        $alerts = [System.Collections.ArrayList]::new()

        $isSystemPath = $false
        foreach ($sp in $systemPaths) {
            if ($imageLoaded -like "$sp\*") { $isSystemPath = $true; break }
        }

        if (-not $isSystemPath) {
            $score += 15
            $alerts.Add("Non-system path") | Out-Null
        }

        if ($signed -eq "false") {
            $score += 25
            $alerts.Add("Unsigned DLL") | Out-Null
        }

        if ($sigStatus -eq "Expired") {
            $score += 20
            $alerts.Add("Expired signature") | Out-Null
        }

        if (-not $description -or $description -eq "-") {
            $score += 10
            $alerts.Add("No description metadata") | Out-Null
        }

        if (-not $company -or $company -eq "-") {
            $score += 5
            $alerts.Add("No company metadata") | Out-Null
        }

        $dllFileName = Split-Path $imageLoaded -Leaf
        if ($originalFileName -and $originalFileName -ne "-" -and $originalFileName -ne $dllFileName) {
            $score += 20
            $alerts.Add("OriginalFileName mismatch: $originalFileName vs $dllFileName") | Out-Null
        }

        $systemDllNames = @("ntdll.dll","kernel32.dll","user32.dll","advapi32.dll","shell32.dll",
                            "ole32.dll","ws2_32.dll","wininet.dll","crypt32.dll","secur32.dll")
        if ($dllFileName.ToLower() -in $systemDllNames -and -not $isSystemPath) {
            $score += 40
            $alerts.Add("System DLL name from non-system path") | Out-Null
        }

        if ($imageLoaded -match "AppData\\Local\\Temp|C:\\Temp|C:\\Users\\Public") {
            $score += 20
            $alerts.Add("Loaded from temp/public directory") | Out-Null
        }

        $level = switch ($score) {
            { $_ -ge 70 } { "CRITICAL" }
            { $_ -ge 50 } { "HIGH" }
            { $_ -ge 30 } { "MEDIUM" }
            { $_ -ge 15 } { "LOW" }
            default { "INFO" }
        }

        if ($IncludeLowRisk -or $score -ge 30) {
            $results.Add([PSCustomObject]@{
                Time = $event.TimeCreated.ToString("yyyy-MM-dd HH:mm:ss")
                HostProcess = $image
                DLLLoaded = $imageLoaded
                Score = $score
                Level = $level
                Alerts = ($alerts -join "; ")
                Signed = $signed
                Hashes = $hashes
                Description = $description
                Product = $product
                Company = $company
            }) | Out-Null
        }
    }

    $sorted = $results | Sort-Object Score -Descending
    $sorted | Export-Csv $OutputPath -NoTypeInformation -Encoding UTF8

    Write-Host "`n=== DLL Hijack Hunt Summary ===" -ForegroundColor Cyan
    Write-Host "Total events analyzed: $($dllEvents.Count)"
    Write-Host "Suspicious findings: $($sorted.Count)"
    Write-Host ""

    $critical = ($sorted | Where-Object { $_.Level -eq "CRITICAL" }).Count
    $high = ($sorted | Where-Object { $_.Level -eq "HIGH" }).Count
    $medium = ($sorted | Where-Object { $_.Level -eq "MEDIUM" }).Count

    Write-Host "CRITICAL: $critical" -ForegroundColor Red
    Write-Host "HIGH:     $high" -ForegroundColor Yellow
    Write-Host "MEDIUM:   $medium" -ForegroundColor DarkYellow
    Write-Host ""
    Write-Host "Report saved to: $OutputPath"

    return $sorted
}

SELECT
    TIMESTAMP AS event_time,
    Computer,
    EventData.Image AS host_process,
    EventData.ImageLoaded AS dll_path,
    EventData.Hashes AS dll_hash,
    EventData.Signed AS dll_signed,
    EventData.SignatureStatus AS sig_status,
    EventData.Description AS dll_description,
    EventData.Company AS dll_company,
    EventData.OriginalFileName AS original_name
FROM
    sysmon_events
WHERE
    EventID = 7
    AND (
        EventData.Signed = 'false'
        OR EventData.ImageLoaded LIKE '%\Users\%\AppData\Local\Temp\%'
        OR EventData.ImageLoaded LIKE '%\Temp\%'
        OR EventData.ImageLoaded LIKE '%\Users\Public\%'
        OR EventData.ImageLoaded LIKE '%\ProgramData\%'
    )
    AND EventData.ImageLoaded NOT LIKE '%\Windows\WinSxS\%'
ORDER BY
    event_time DESC

SELECT
    t1.event_time AS dll_load_time,
    t1.Computer,
    t1.EventData.Image AS host_process,
    t1.EventData.ImageLoaded AS suspicious_dll,
    t2.event_time AS child_process_time,
    t2.EventData.CommandLine AS child_command,
    DATEDIFF(second, t1.event_time, t2.event_time) AS time_delta_seconds
FROM
    sysmon_events t1
JOIN
    sysmon_events t2
ON
    t1.EventData.ProcessGuid = t2.EventData.ParentProcessGuid
WHERE
    t1.EventID = 7
    AND t2.EventID = 1
    AND t1.EventData.Signed = 'false'
    AND t1.EventData.ImageLoaded NOT LIKE '%\Windows\%'
    AND DATEDIFF(second, t1.event_time, t2.event_time) BETWEEN 0 AND 60
ORDER BY
    t1.event_time DESC

title: DLL Search Order Hijacking - Suspicious DLL Load
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: 检测从非标准路径加载的未签名 DLL，可能是 DLL 搜索顺序劫持
author: Security Team
date: 2026/06/24
references:
    - https://attack.mitre.org/techniques/T1574/001/
tags:
    - attack.defense_evasion
    - attack.persistence
    - attack.t1574.001
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 7
        Signed: 'false'
    filter_system_paths:
        ImageLoaded|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
            - 'C:\Windows\WinSxS\'
            - 'C:\Windows\assembly\'
    filter_signed_apps:
        SignatureStatus: 'Valid'
    filter_known_vendors:
        ImageLoaded|contains:
            - '\Program Files\'
            - '\Program Files (x86)\'
    condition: selection and not 1 of filter_*
fields:
    - Image
    - ImageLoaded
    - Hashes
    - Description
    - Product
    - Company
falsepositive:
    - 合法应用程序从非标准路径加载自定义 DLL
    - 开发环境中的调试 DLL
level: medium

title: COM Object Hijacking - Suspicious Registry Modification
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
status: experimental
description: 检测用户级 COM 对象注册表的异常修改，可能是 COM 劫持
author: Security Team
date: 2026/06/24
references:
    - https://attack.mitre.org/techniques/T1574/015/
tags:
    - attack.persistence
    - attack.privilege_escalation
    - attack.t1574.015
logsource:
    product: windows
    service: sysmon
detection:
    selection_registry:
        EventID: 13
        TargetObject|contains: '\SOFTWARE\Classes\CLSID\'
    selection_values:
        TargetObject|contains:
            - '\InprocServer32\'
            - '\LocalServer32\'
            - '\TreatAs\'
    filter_system:
        TargetObject|contains:
            - 'HKLM\'
    filter_known_apps:
        Image|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
    condition: (selection_registry and selection_values) and not 1 of filter_*
fields:
    - Image
    - TargetObject
    - Details
falsepositive:
    - 合法应用程序安装时注册 COM 组件
    - 用户级应用程序的正常 COM 注册
level: high

title: DLL Side-Loading - Signed Binary Loads Unsigned DLL
id: c3d4e5f6-a7b8-9012-cdef-123456789012
status: experimental
description: 检测签名应用程序加载未签名 DLL 的行为，可能是 DLL 侧加载
author: Security Team
date: 2026/06/24
references:
    - https://attack.mitre.org/techniques/T1574/002/
tags:
    - attack.defense_evasion
    - attack.t1574.002
logsource:
    product: windows
    service: sysmon
detection:
    selection_dll_load:
        EventID: 7
        Signed: 'false'
    filter_system_dlls:
        ImageLoaded|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
            - 'C:\Windows\WinSxS\'
    filter_temp_known:
        ImageLoaded|contains: '\WinSxS\'
    condition: selection_dll_load and not 1 of filter_*
fields:
    - Image
    - ImageLoaded
    - Hashes
    - Description
falsepositive:
    - 应用程序加载自身目录中的自定义插件
    - 开发工具加载开发环境 DLL
level: medium

title: Phantom DLL Hijacking - Previously Missing DLL Now Loaded
id: d4e5f6a7-b8c9-0123-defa-234567890123
status: experimental
description: 检测之前加载失败但现在成功加载的 DLL，可能是 Phantom DLL 劫持
author: Security Team
date: 2026/06/24
references:
    - https://attack.mitre.org/techniques/T1574/001/
tags:
    - attack.persistence
    - attack.privilege_escalation
    - attack.t1574.001
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 7
        Signed: 'false'
        Description: '-'
        Company: '-'
        Product: '-'
    filter_system:
        ImageLoaded|startswith:
            - 'C:\Windows\'
    filter_program_files:
        ImageLoaded|startswith:
            - 'C:\Program Files\'
            - 'C:\Program Files (x86)\'
    condition: selection and not 1 of filter_*
fields:
    - Image
    - ImageLoaded
    - Hashes
falsepositive:
    - 新安装的应用程序首次加载其自定义 DLL
    - 应用程序更新后引入的新 DLL
level: high